ansible/roles/nftables_infra/templates/nftables.d/20-blacklist.conf.j2

{{ ansible_managed | comment }}

table inet blacklist {

	set blacklist_ipv4 {
		type ipv4_addr
		flags interval
	}

	set blacklist_ipv6 {
		type ipv6_addr
		flags interval
	}

	counter blacklist {}

	chain filter {
		type filter hook prerouting priority raw - 10
		policy accept

		ip6 saddr @blacklist_ipv6 counter name blacklist drop
		ip saddr @blacklist_ipv4 counter name blacklist drop
	}

}